85b5092f20f1e18727883a2a7de252fc05d29d67e20ea728dcbd042b9c6c67dd

Sharing

Copy URL Twitter E-mail

General

Target

85b5092f20f1e18727883a2a7de252fc05d29d67e20ea728dcbd042b9c6c67dd
Size

67KB
MD5

c3d30ccdb86062dfeac2601a549dc217
SHA1

ca5057a27d5d5e89ec45b8850dc57bcb15c7420e
SHA256

85b5092f20f1e18727883a2a7de252fc05d29d67e20ea728dcbd042b9c6c67dd
SHA512

9b874eb6b04e49f4e64045c1074314bd5e419f8aa2273f6914c045b8fe9b14f3a5df1689bea26b246ea417e82560e28a4ee766a8bd7f1c11df2447048ab8a2ce
SSDEEP

768:p0iaY4+uuxYEZoLJsJ9rmo+BaUPFA7Bcx8spfk8szVx9zX3Rt/oC9zzi:RaHux4LUdQFuBcpSDzVjzXhtAez

Score

1^/10

Malware Config

Signatures

Files

85b5092f20f1e18727883a2a7de252fc05d29d67e20ea728dcbd042b9c6c67dd
.exe windows x64

c624497640a8257a63c8a307a4c2c75e

Code Sign

33:00:00:05:00:27:d6:32:6f:43:73:7b:87:00:00:00:00:05:00
Certificate

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/02/2023, 20:11

Not After

31/01/2024, 20:11

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0c:52:4c:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06/07/2010, 20:40

Not After

06/07/2025, 20:50

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:03:3e:63:3a:86:bf:41:73:d7:e0:00:00:00:00:03:3e
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/02/2023, 20:10

Not After

31/01/2024, 20:10

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

3c:55:ed:46:c7:33:fc:9e:3e:80:21:5e:36:df:ca:7d:dc:e0:55:af:57:d4:97:86:23:6d:82:11:9a:38:45:a3
Signer

Actual PE Digest

3c:55:ed:46:c7:33:fc:9e:3e:80:21:5e:36:df:ca:7d:dc:e0:55:af:57:d4:97:86:23:6d:82:11:9a:38:45:a3

Digest Algorithm

sha256

PE Digest Matches

false

3c:55:ed:46:c7:33:fc:9e:3e:80:21:5e:36:df:ca:7d:dc:e0:55:af:57:d4:97:86:23:6d:82:11:9a:38:45:a3
Signer

Actual PE Digest

3c:55:ed:46:c7:33:fc:9e:3e:80:21:5e:36:df:ca:7d:dc:e0:55:af:57:d4:97:86:23:6d:82:11:9a:38:45:a3

Digest Algorithm

sha256

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

CreateThread
DeleteCriticalSection
EnterCriticalSection
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetLastError
GetStartupInfoA
GetSystemTimeAsFileTime
GetTickCount
InitializeCriticalSection
LeaveCriticalSection
QueryPerformanceCounter
RtlAddFunctionTable
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
SetUnhandledExceptionFilter
Sleep
TerminateProcess
TlsGetValue
UnhandledExceptionFilter
VirtualAlloc
VirtualProtect
VirtualQuery
WaitForSingleObject

msvcrt

__C_specific_handler
__getmainargs
__initenv
__iob_func
__lconv_init
__set_app_type
__setusermatherr
_acmdln
_amsg_exit
_cexit
_fmode
_initterm
_onexit
_stat64
_time64
abort
calloc
exit
fprintf
free
fwrite
malloc
memcpy
memset
signal
strlen
strncmp
vfprintf

winhttp

WinHttpCloseHandle
WinHttpConnect
WinHttpOpen
WinHttpOpenRequest
WinHttpQueryDataAvailable
WinHttpReadData
WinHttpReceiveResponse
WinHttpSendRequest

Sections

.text
Size: 36KB - Virtual size: 35KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.pdata
Size: 1024B - Virtual size: 600B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.xdata
Size: 512B - Virtual size: 492B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 2KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 104B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

c624497640a8257a63c8a307a4c2c75e

Code Sign

33:00:00:05:00:27:d6:32:6f:43:73:7b:87:00:00:00:00:05:00Certificate

Extended Key Usages

61:0c:52:4c:00:00:00:00:00:03Certificate

Key Usages

33:00:00:03:3e:63:3a:86:bf:41:73:d7:e0:00:00:00:00:03:3eCertificate

Extended Key Usages

61:0e:90:d2:00:00:00:00:00:03Certificate

Key Usages

3c:55:ed:46:c7:33:fc:9e:3e:80:21:5e:36:df:ca:7d:dc:e0:55:af:57:d4:97:86:23:6d:82:11:9a:38:45:a3Signer

3c:55:ed:46:c7:33:fc:9e:3e:80:21:5e:36:df:ca:7d:dc:e0:55:af:57:d4:97:86:23:6d:82:11:9a:38:45:a3Signer

Headers

File Characteristics

Imports

kernel32

msvcrt

winhttp

Sections

.text Size: 36KB - Virtual size: 35KB

.data Size: 1KB - Virtual size: 1KB

.rdata Size: 4KB - Virtual size: 4KB

.pdata Size: 1024B - Virtual size: 600B

.xdata Size: 512B - Virtual size: 492B

.bss Size: - Virtual size: 2KB

.idata Size: 2KB - Virtual size: 2KB

.CRT Size: 512B - Virtual size: 104B

.tls Size: 512B - Virtual size: 16B

33:00:00:05:00:27:d6:32:6f:43:73:7b:87:00:00:00:00:05:00
Certificate

61:0c:52:4c:00:00:00:00:00:03
Certificate

33:00:00:03:3e:63:3a:86:bf:41:73:d7:e0:00:00:00:00:03:3e
Certificate

61:0e:90:d2:00:00:00:00:00:03
Certificate

3c:55:ed:46:c7:33:fc:9e:3e:80:21:5e:36:df:ca:7d:dc:e0:55:af:57:d4:97:86:23:6d:82:11:9a:38:45:a3
Signer

3c:55:ed:46:c7:33:fc:9e:3e:80:21:5e:36:df:ca:7d:dc:e0:55:af:57:d4:97:86:23:6d:82:11:9a:38:45:a3
Signer

.text
Size: 36KB - Virtual size: 35KB

.data
Size: 1KB - Virtual size: 1KB

.rdata
Size: 4KB - Virtual size: 4KB

.pdata
Size: 1024B - Virtual size: 600B

.xdata
Size: 512B - Virtual size: 492B

.bss
Size: - Virtual size: 2KB

.idata
Size: 2KB - Virtual size: 2KB

.CRT
Size: 512B - Virtual size: 104B

.tls
Size: 512B - Virtual size: 16B